Handle auth.roles listener directly from orchestra/foundation.

Signed-off-by: crynobone <crynobone@gmail.com>